<div dir="ltr">Hi Slawek,<div><br></div><div>Yes, after adding extension, SG created with stateful=false.</div><div><br></div><div># neutron ext-list | grep stateful-security-group<br>neutron CLI is deprecated and will be removed in the Z cycle. Use openstack CLI instead.<br>| stateful-security-group | Stateful security group<br></div><div><br></div><div># openstack security group create --stateless sec02-stateless<br>+-----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+<br>| Field | Value |<br>+-----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+<br>| created_at | 2021-11-02T09:02:42Z |<br>| description | sec02-stateless |<br>| id | 29c28678-9a03-496c-8157-4afbcdc8f2af |<br>| name | sec02-stateless |<br>| project_id | 98687873a146418eaeeb54a01693669f |<br>| revision_number | 1 |<br>| rules | created_at='2021-11-02T09:02:42Z', direction='egress', ethertype='IPv6', id='17079c04-dc1d-4fbd-9f15-e79c6e585932', standard_attr_id='2863', updated_at='2021-11-02T09:02:42Z' |<br>| | created_at='2021-11-02T09:02:42Z', direction='egress', ethertype='IPv4', id='fadfbf09-f759-453d-b493-e6f73077113a', standard_attr_id='2860', updated_at='2021-11-02T09:02:42Z' |<br>| stateful | False |<br>| tags | [] |<br>| updated_at | 2021-11-02T09:02:42Z |<br>+-----------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+<br></div><div><br></div><div>Let me test this feature further.</div><div><br></div><div>Ammad</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 2, 2021 at 1:54 PM Slawek Kaplonski <<a href="mailto:skaplons@redhat.com">skaplons@redhat.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
On wtorek, 2 listopada 2021 09:29:13 CET Ammad Syed wrote:<br>
> Thanks Lajos,<br>
> <br>
> I was checking the release notes and found that stateless acl is supported<br>
> by ovn in xena.<br>
> <br>
> <a href="https://docs.openstack.org/releasenotes/neutron/" rel="noreferrer" target="_blank">https://docs.openstack.org/releasenotes/neutron/</a><br>
xena.html#:~:text=Support%20st<br>
> ateless%20security%20groups%20with%20the%20latest%20OVN%2021.06%2B.<br>
%20The%20st<br>
> <br>
ateful%3DFalse%20security%20groups%20are%20mapped%20to%20the%20new%20%E2%80%9C<br>
> allow-stateless%E2%80%9D%20OVN%20ACL%20verb .<br>
<br>
It should be supported by the OVN driver now IIRC. Maybe we forgot about <br>
adding this extension to the list: <a href="https://github.com/openstack/neutron/blob/master/neutron/common/ovn/extensions.py#L93" rel="noreferrer" target="_blank">https://github.com/openstack/neutron/blob/<br>
master/neutron/common/ovn/extensions.py#L93</a><br>
Can You try to add it there and see if the extension will be loaded then?<br>
<br>
> <br>
> Ammad<br>
> <br>
> On Tue, Nov 2, 2021 at 1:25 PM Lajos Katona <<a href="mailto:katonalala@gmail.com" target="_blank">katonalala@gmail.com</a>> wrote:<br>
> > Hi,<br>
> > statefull security-groups are only available with iptables based drivers:<br>
> > <br>
> > <a href="https://review.opendev.org/c/openstack/neutron/+/572767/53/releasenotes/" rel="noreferrer" target="_blank">https://review.opendev.org/c/openstack/neutron/+/572767/53/releasenotes/</a><br>
note<br>
> > s/stateful-security-group-04b2902ed9c44e4f.yaml<br>
> > <br>
> > For OVS and OVN we have open RFE, nut as I know at the moment nobody works<br>
> > on them:<br>
> > <a href="https://bugs.launchpad.net/neutron/+bug/1885261" rel="noreferrer" target="_blank">https://bugs.launchpad.net/neutron/+bug/1885261</a><br>
> > <a href="https://bugs.launchpad.net/neutron/+bug/1885262" rel="noreferrer" target="_blank">https://bugs.launchpad.net/neutron/+bug/1885262</a><br>
> > <br>
> > Regards<br>
> > Lajos Katona (lajoskatona)<br>
> > <br>
> > Ammad Syed <<a href="mailto:syedammad83@gmail.com" target="_blank">syedammad83@gmail.com</a>> ezt írta (időpont: 2021. nov. 2., K,<br>
> > <br>
> > 9:00):<br>
> >> Hi,<br>
> >> <br>
> >> I have upgraded my lab to latest xena release and ovn 21.09 and ovs 2.16.<br>
> >> I am trying to create stateless security group. But its getting failed <br>
with<br>
> >> below error message.<br>
> >> <br>
> >> # openstack security group create --stateless sec02-stateless<br>
> >> Error while executing command: BadRequestException: 400, Unrecognized<br>
> >> attribute(s) 'stateful'<br>
> >> <br>
> >> I see below logs in neutron server logs.<br>
> >> <br>
> >> 2021-11-02 12:47:41.921 1346 DEBUG neutron.wsgi [-] (1346) accepted<br>
> >> ('172.16.40.45', 41272) server<br>
> >> /usr/lib/python3/dist-packages/eventlet/wsgi.py:992<br>
> >> 2021-11-02 12:47:42.166 1346 DEBUG neutron.api.v2.base<br>
> >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481 <br>
19844bf62a7b498eb443508ef150e9b8<br>
> >> 98687873a146418eaeeb54a01693669f - default default] Request body:<br>
> >> {'security_group': {'name': 'sec02-stateless', 'stateful': False,<br>
> >> 'description': 'sec02-stateless'}} prepare_request_body<br>
> >> /usr/lib/python3/dist-packages/neutron/api/v2/base.py:729<br>
> >> 2021-11-02 12:47:42.167 1346 WARNING neutron.api.v2.base<br>
> >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481 <br>
19844bf62a7b498eb443508ef150e9b8<br>
> >> 98687873a146418eaeeb54a01693669f - default default] An exception happened<br>
> >> while processing the request body. The exception message is [Unrecognized<br>
> >> attribute(s) 'stateful'].: webob.exc.HTTPBadRequest: Unrecognized<br>
> >> attribute(s) 'stateful'<br>
> >> 2021-11-02 12:47:42.167 1346 INFO neutron.api.v2.resource<br>
> >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481 <br>
19844bf62a7b498eb443508ef150e9b8<br>
> >> 98687873a146418eaeeb54a01693669f - default default] create failed (client<br>
> >> error): Unrecognized attribute(s) 'stateful'<br>
> >> 2021-11-02 12:47:42.168 1346 INFO neutron.wsgi<br>
> >> [req-b6a37fff-090f-4754-9df7-6e4314ed9481 <br>
19844bf62a7b498eb443508ef150e9b8<br>
> >> 98687873a146418eaeeb54a01693669f - default default] 172.16.40.45 "POST<br>
> >> /v2.0/security-groups HTTP/1.1" status: 400 len: 317 time: 0.2455938<br>
> >> <br>
> >> Any advice on how to fix it ?<br>
> >> <br>
> >> Ammad<br>
<br>
<br>
-- <br>
Slawek Kaplonski<br>
Principal Software Engineer<br>
Red Hat</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">Regards,<div><br></div><div><br></div><div>Syed Ammad Ali</div></div>